Gödel's sentence is an adversarial example but unsolvable.
problem The existence and unsolvability of adversarial examples.
method Analysis of non-isomorphic natural explanations and computability theory.
result Gödel's sentence is an adversarial example that cannot be solved.
Paper generates natural adversarial examples for hyperspectral data.
problem Creating adversarial examples for black-box models.
method Modified Wasserstein GAN reweights true data distribution.
result Successfully generates adversarial hyperspectral signatures.
3D models vulnerable to adversarial attacks, new method improves success rate and naturalness.
problem Vulnerability of 3D deep learning models to adversarial examples in the physical world.
method ε-isometric (ε-ISO) attack considering geometric properties and invariance to physical transformations. result Significantly improved attack success rate and naturalness of 3D adversarial examples.
Approach generates adversarial text examples for robustness testing.
problem Measuring and improving the robustness of text classifiers.
method Reinforcement learning in a black-box setting.
result Successfully fools trained models with high success rates.
This paper proposes SPT to generate diverse and transferable adversarial examples.
problem Limitations of recent adversarial examples in diversity and transferability.
method Structure-preserving transformation (SPT) to generate natural and diverse adversarial examples.
result Adversarial examples generated by SPT transfer well to other models with high success rate.
In recent years, neural networks have demonstrated outstanding effectiveness in a large amount of applications.However, recent works have shown that neural networks are susceptible to adversarial examples, indicating possible flaws intrinsic to the network structures. To address this problem and improve the robustness …
This paper introduces metrics to evaluate robustness of neural networks to natural adversarial examples.
problem Measuring robustness of neural networks to natural adversarial examples.
method Proposes latent space performance metrics based on generative models.
result Latent adversarial perturbations are often perceptually small and associated with classifier accuracy.
Efficiently distills white-box adversarial attacks into black-box models.
problem Generating efficient adversarial examples for robustness.
method Train a model to emulate white-box attack behavior and distill it into a more efficient black-box model.
result Reduces adversarial example generation time by 19x-39x and transfers to black-box settings.
A new method generates natural-looking adversarial examples by bounding internal activation values.
problem Creating natural-looking adversarial examples that closely mimic the original input.
method Bounding internal activation values through a distribution quantile bound and polynomial barrier loss function.
result Our attack achieves similar success and confidence levels as state-of-the-art methods but with more natural-looking perturbations.
This paper tackles adversarial examples in NLI models by integrating logical background knowledge.
problem Generating adversarial examples that violate logical constraints in NLI models.
method Reduces adversarial example generation to combinatorial optimisation, using a language model to generate plausible examples.
result Significantly improves NLI model accuracy on adversarial datasets, up to 79.6% relative improvement.
ADT improves model robustness by learning adversarial distributions.
problem Ineffective robustness against unseen attacks due to specific attack algorithms.
method Formulates adversarial distributional training as a minimax optimization problem, learning adversarial distributions and training robust models.
result Empirical validation of ADT's effectiveness compared to state-of-the-art methods.
This paper generates natural-looking perturbations to fool classifiers.
problem Generating adversarial examples that mimic natural objects or signals.
method Employing generative adversarial networks and optimization algorithms.
result The approach can fool classification models in both image and audio domains.
New adversarial examples with structured distortion sets improve robustness and perceptibility.
problem Improving adversarial robustness and perceptibility of images.
method Exploring and constraining adversarial search with trace-norms and other norms.
result Structured adversarial perturbations allow larger distortions and control over generation.
Proposes BATer for improved adversarial example detection.
problem Detecting adversarial examples in neural networks.
method Introduces a Bayesian adversarial example detector (BATer) using random components in a Bayesian neural network.
result BATer outperforms state-of-the-art detectors in adversarial example detection.
Geometric analysis reveals how adversarial examples arise from model boundaries.
problem Adversarial examples cause misclassifications in machine learning models.
method Geometric framework using manifold reconstruction tools.
result Adversarial examples are a consequence of model boundaries on low-dimensional data manifolds.
Enhances single-step adversarial training to defend against iterative adversarial examples.
problem Defending against iterative adversarial examples in neural networks.
method Identified and leveraged empirical properties of Iter-Adv to improve Single-Adv.
result Enhanced Single-Adv to defend against iterative adversarial examples with improved accuracy and reduced training cost.
Free adversarial training improves robustness without generating adversarial examples.
problem Training robust models against adversarial attacks is costly and impractical for large-scale datasets.
method Recycles gradient information from parameter updates to generate adversarial examples.
result Free adversarial training achieves comparable robustness to PGD training at negligible cost.
GanDef uses GANs to defend against adversarial examples in neural networks.
problem Defending against adversarial examples in neural networks.
method GAN-based adversarial training defense using a competition game to regulate feature selection.
result GanDef trains a classifier to defend against adversarial examples with high accuracy.
Proposes a new adversarial gain measure for NLP tasks.
problem Lack of a unified adversarial model for NLP tasks.
method Defines adversarial gain based on control theory.
result Provides a measure for evaluating adversaries and defenses.
Several machine learning models, including neural networks, consistently misclassify adversarial examples---inputs formed by applying small but intentionally worst-case perturbations to examples from the dataset, such that the perturbed input results in the model outputting an incorrect answer with high confidence. Ear…
This paper proposes a technique to prioritize examples based on their noise sensitivity for generating adversarial examples.
problem Generating effective adversarial examples requires careful consideration of noise sensitivity.
method The paper introduces a noise-sensitivity-analysis-based test prioritization technique to identify examples sensitive to noise.
result The method effectively picks out examples by their noise sensitivity, improving the effectiveness of adversarial examples.
Domain knowledge helps detect adversarial examples in multi-label classification.
problem Detecting adversarial examples in multi-label classification.
method Convert domain knowledge into constraints and inject them into a semi-supervised learning problem.
result Domain-knowledge constraints help detect adversarial examples effectively.
New global adversarial attacks improve DNN robustness assessment.
problem Vulnerability of deep neural networks to adversarial attacks.
method Proposed global adversarial example pairs and attack methods.
result DNNs hardened with local adversarial training are vulnerable to global attacks.
Charmer improves character-level adversarial attacks for language models.
problem Efficiency and effectiveness of character-level adversarial attacks for language models.
method Query-based adversarial attack method that maintains semantic similarity.
result Charmer achieves high attack success rate and similar adversarial examples.
STRATA generates code adversarial examples efficiently without gradients.
problem Generating adversarial examples for code that retains functional meaning.
method Uses token frequency statistics to construct gradient-free adversarial examples.
result Empirically outperforms gradient-based methods with less information and effort.
Adversarial examples and noisy images share a common cause.
problem Improving machine learning models' robustness to adversarial attacks and random noise.
method Empirical and theoretical analysis of adversarial examples and corrupted images.
result Adversarial robustness and corruption robustness are closely related.
This paper studies adversarial examples in NIDS, revealing their vulnerability.
problem Vulnerability of machine learning-based NIDS to adversarial examples.
method Used evolutionary computation and deep learning to generate adversarial examples.
result Adversarial examples cause high misclassification rates in various machine learning models.
Localized adversarial training improves image classifiers' robustness.
problem State-of-the-art image classifiers fail on carefully manipulated adversarial images.
method Developed a localized adversarial attack and used it to train a robust classifier.
result Localized adversarial training increases robustness against adversarial inputs.
Adversarial training improves model robustness with Voronoi constraints.
problem Adversarial examples mislead machine learning models, leading to incorrect classifications.
method Geometric framework using Voronoi cells to constrain adversarial training.
result Adversarial training with Voronoi constraints produces robust models.
New methods improve adversarial attacks' transferability to other models.
problem Vulnerability of deep learning models to adversarial examples.
method Nesterov Iterative Fast Gradient Sign Method (NI-FGSM) and Scale-Invariant attack Method (SIM).
result NI-FGSM and SIM generate more transferable adversarial examples.
Paper generates diverse, readable adversarial texts from scratch.
problem Text classification models are easily fooled by adversarial examples.
method Trained a conditional variational autoencoder (VAE) with adversarial loss and utilized GANs to generate consistent adversarial texts.
result Successfully generates adversarial texts with higher success rate and acceptable quality.
New method improves model robustness against adversarial examples.
problem Tackles model robustness against adversarial examples.
method Exploits energy function to describe stability and minimizes lower bound of energy function.
result Proves better robustness than previous methods.
Proposes a new method to generate unrestricted adversarial examples.
problem Generating unrestricted adversarial examples without norm constraints.
method Leveraging state-of-the-art generative models to manipulate image fine-grained aspects.
result Our adversarial images look indistinguishable from natural images and can bypass certified defenses.
New method improves interpretability of text adversarial examples.
problem Generating interpretable adversarial examples in text is challenging.
method Sparse Projected Gradient Descent (SPGD) with directional and sparsity constraints.
result Improves interpretability and likelihood of adversarial examples compared to state-of-the-art methods.
This paper introduces a database to assess the perceptual similarity of adversarial images.
problem The lack of reliable metrics to assess the perceptual similarity of adversarial images generated by Lp norms. method Creation of a database and evaluation of fifteen FR image fidelity assessment metrics.
result The database and metrics can help in designing new metrics for adversarial examples.
Study shows computational hardness can improve adversarial robustness in learning.
problem Developing robust machine learning models against adversarial attacks.
method Investigate if computational limitations of attackers can enhance robustness.
result Demonstrated a learning task where computational robustness outperforms information-theoretic robustness.
High-dimensional neural network manifolds misalign with human perception, causing adversarial examples.
problem Adversarial attacks fool neural networks, but their origin is unclear.
method Defined and analyzed a network's perceptual manifold (PM) for a class concept.
result Neural network PMs have orders of magnitude higher dimensions than natural human concepts, suggesting exponential misalignment.
The paper tackles adversarial attacks on recurrent neural networks.
problem Adversarial attacks on recurrent neural networks are easy and lack theoretical guarantees.
method Inspired by dynamical systems theory, the paper dynamically computes adversarial perturbations for each timestep of the input sequence.
result The paper provides theoretical guarantees on the existence of adversarial examples and robustness margins.
The paper shows tree models are vulnerable to adversarial examples and develops a robust algorithm.
problem Vulnerability of tree-based models to adversarial examples.
method Develops a novel algorithm to learn robust trees by optimizing performance under worst-case perturbation of input features.
result The proposed algorithms substantially improve the robustness of tree-based models against adversarial examples.
New method generates adversarial examples using Wasserstein distance.
problem Creating robust classifiers against image manipulations.
method Developed a procedure to project onto Wasserstein ball using modified Sinkhorn iteration.
result Successfully attacked image classification models with 3% accuracy within a 10% pixel mass movement.
Note that this paper is superceded by "Black-Box Adversarial Attacks with Limited Queries and Information." Current neural network-based image classifiers are susceptible to adversarial examples, even in the black-box setting, where the attacker is limited to query access without access to gradients. Previous methods -…
Federated learning can be vulnerable to adversarial attacks, which this work addresses.
problem Federated learning's adversarial vulnerability when deployed.
method Bias-Variance decomposition for federated learning, proposing Fed_BVA framework.
result Fed_BVA framework generates adversarial examples to improve robustness.
In recent years, defending adversarial perturbations to natural examples in order to build robust machine learning models trained by deep neural networks (DNNs) has become an emerging research field in the conjunction of deep learning and security. In particular, MagNet consisting of an adversary detector and a data re…
New deep learning models inspired by fuzzy logic are more robust to adversarial attacks.
problem Flawed generalization in deep neural networks leading to adversarial examples.
method Inspired by fuzzy logic, new architectures combining alternative design elements.
result New models are more robust to adversarial examples and noise.
Recent work has demonstrated that deep neural networks are vulnerable to adversarial examples---inputs that are almost indistinguishable from natural data and yet classified incorrectly by the network. In fact, some of the latest findings suggest that the existence of adversarial attacks may be an inherent weakness of …
Simple framework explains adversarial examples with small changes.
problem Understanding the ease of switching between decisions in targeted attacks.
method Developed a mathematical framework based on the geometry of L0 (Hamming) metric. result Quantitatively analyzed the number of input coordinates to change for misdirection.
New framework explains adversarial examples in neural nets.
problem Adversarial examples in deep neural networks are counterintuitive and hard to explain.
method Introduces Dimpled Manifold Model to explain training phases and adversarial examples.
result Shows how adversarial examples arise from training dynamics and dimpling phase.
Fueled by massive amounts of data, models produced by machine-learning (ML) algorithms, especially deep neural networks, are being used in diverse domains where trustworthiness is a concern, including automotive systems, finance, health care, natural language processing, and malware detection. Of particular concern is …